Quick answers
- Is CVE-2026-39850 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-39850 being exploited in the wild.
- How severe is CVE-2026-39850?
- High severity, with a CVSS score of 7.4, published 20 May 2026.
- Which products and versions are affected?
- yiisoft/yii2 (Packagist) < 2.0.55, ECOSYSTEM:introduced=0,fixed=2.0.55; Yii Software Yii 2 <= 2.0.54.
- Is there a fix for CVE-2026-39850?
- Yes. yiisoft/yii2 (Packagist): upgrade to 2.0.55 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-39850 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-39850?
- Check whether you run yiisoft/yii2 (Packagist) or Yii Software Yii 2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- yiisoft/yii2 (Packagist): upgrade to 2.0.55 or later
composer require yiisoft/yii2:^2.0.55
Technical details
The core view rendering method View::renderPhpFile() is vulnerable to Local File Inclusion (LFI) due to a variable name collision. The method calls PHP's extract() function on user-supplied parameters with the EXTR_OVERWRITE flag before requiring the view file. An attacker providing a parameter named '_file_' can overwrite the internal local variable used to determine which file is included. This allows for arbitrary file read of non-PHP files and potential Remote Code Execution (RCE) if the attacker can influence the content of a file on the local filesystem. The issue is fixed in version 2.0.55.
Affected products
- yiisoft yii2 < 2.0.55
Identifiers
- CVE-2026-39850
- GHSA-5vpg-rj7q-qpw2
Timeline
- 2026-05-09: disclosed: Initial disclosure by reporter khuroohamid
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-11: patched: Version 2.0.55 released